CVE-2024-55076High 8.1Grocy through 4.3.0 has no CSRF protection, as demonstrated by changing the Administrator's password.0.3%
CVE-2024-55075Medium 4.3Grocy through 4.3.0 allows remote attackers to obtain sensitive information via direct requests to pages that are not shown in the UI, such as calendar and recipes.0.5%
CVE-2024-55074High 8.8The edit profile function of Grocy through 4.3.0 allows stored XSS and resultant privilege escalation by uploading a crafted HTML or SVG file, a different issue than CVE-2024-8370.0.7%